From 9630d412af005c33a6fe3ee25b2f8bd83249724c Mon Sep 17 00:00:00 2001
From: lachtan obecny <martin.blazik@gmail.com>
Date: Thu, 22 Oct 2026 10:59:26 +0200
Subject: [PATCH] Limit ssh key lifetime to 12h in SSH sessions

---
 CLAUDE.md       |  1 +
 functions.sh    |  5 +++++
 rc/ssh-agent.sh | 14 +++++++++++++-
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index d1abc59..b93f543 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -19,6 +19,7 @@ and adds `bin/` to PATH. `$LWS` points to repo root.
 - `is_slow_init` / `is_fast_init` — check `LWS_FAST` mode
 - `is_interactive_shell` — true when `[[ $- == *i* ]]`
 - `is_wsl` — detect WSL environment
+- `is_ssh_session` — true when logged in over SSH
 - `true_false <val>` — normalize `1/true/yes` to boolean
 - `prepend_path` / `append_path` / `prepend_path_try` / `append_path_try` — safe PATH manipulation
 - `source_try <file>` — source file if it exists
diff --git a/functions.sh b/functions.sh
index 14c478f..7a430ad 100644
--- a/functions.sh
+++ b/functions.sh
@@ -156,3 +156,8 @@ function true_false() {
 function is_wsl() {
   grep -q -i wsl /proc/version
 }
+
+function is_ssh_session() {
+  # sshd sets SSH_CONNECTION only in sessions opened over SSH
+  [[ -n "${SSH_CONNECTION:-}" ]]
+}
diff --git a/rc/ssh-agent.sh b/rc/ssh-agent.sh
index bd21329..fa72a57 100644
--- a/rc/ssh-agent.sh
+++ b/rc/ssh-agent.sh
@@ -7,6 +7,13 @@ function _log() {
 _SSH_AGENT_NO_KEYS=1
 _SSH_AGENT_NOT_RUNNING=2
 
+SSH_KEY_TIMEOUT_HOURS=${SSH_KEY_TIMEOUT_HOURS:-12}
+SSH_KEY_TIMEOUT_MINUTES=$((SSH_KEY_TIMEOUT_HOURS * 60))
+
+function _should_limit_key_lifetime() {
+  ! is_wsl && is_ssh_session
+}
+
 for key in id_ecdsa id_rsa; do
   key_filename="$HOME/.ssh/$key"
 
@@ -43,7 +50,12 @@ for key in id_ecdsa id_rsa; do
         ssh-add "$key_filename"
       fi
     else
-      eval "$(keychain --eval --quiet --agents ssh $key)"
+      keychain_args=()
+      if _should_limit_key_lifetime; then
+        _log "Limiting key lifetime to $SSH_KEY_TIMEOUT_HOURS hours"
+        keychain_args=(--timeout "$SSH_KEY_TIMEOUT_MINUTES")
+      fi
+      eval "$(keychain --eval --quiet "${keychain_args[@]}" --agents ssh $key)"
     fi
 
     break